HackZoneLabs News
Newsletter

CVE records

39811 records, newest first. We hold CVEs that were published recently, that are in the CISA KEV catalogue, or that an article mentions.

CVETitlePublishedTop scoreKEV
CVE-2026-125858WordPress CleverReach® WP plugin <= 1.5.26 - Broken Access Control vulnerability13 Nov 20266.3
CVE-2026-125856WordPress Dynamic User Directory plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability13 Nov 20267.1
CVE-2026-125854WordPress Unbounce Landing Pages plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability13 Nov 20267.1
CVE-2026-125855WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.9 - PHP Object Injection vulnerability13 Nov 20269.8
CVE-2026-125837WordPress Make theme <= 1.10.10 - Cross Site Scripting (XSS) vulnerability13 Nov 20267.1
CVE-2026-125853WordPress Everest Backup plugin <= 2.3.14 - Broken Access Control vulnerability13 Nov 20266.5
CVE-2026-125852WordPress Realtyna Organic IDX plugin plugin <= 5.4.2 - Arbitrary File Deletion vulnerability13 Nov 20267.7
CVE-2026-103769WordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.4.10 - PHP Object Injection vulnerability13 Nov 20267.2
CVE-2026-125452WordPress WPJAM Basic plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability13 Nov 20267.1
CVE-2026-8217513 Nov 20263.8
CVE-2026-123975Grid Community Toolkit globus-gss-assist before 12.9 Pre-Authentication Heap Out-of-Bounds Write13 Nov 20268.7
CVE-2026-128990xschem 2.9.9 through 3.4.7 Heap Out-of-Bounds Write via rawtovcd read_dataset()13 Nov 20268.5
CVE-2026-128991xschem 2.9.9 through 3.4.7 Out-of-Bounds Read via read_xschem_file() Embedded-Symbol Record13 Nov 20265.8
CVE-2026-109092X.Org Server XvShmPutImage Shared-Memory Bounds Overflow13 Nov 20267.8
CVE-2026-10752213 Nov 20267.2
CVE-2026-125802WordPress Spectra plugin <= 2.20.5 - Sensitive Data Exposure vulnerability13 Nov 20265.3
CVE-2026-125825WordPress RepairBuddy plugin <= 4.1236 - Broken Access Control vulnerability13 Nov 20265.3
CVE-2026-109445PLANET GS-5220-8P2T2S Stack Buffer Overflow via webstax_auth Cookie13 Nov 20269.8
CVE-2026-10752313 Nov 20268.7
CVE-2026-125794WordPress Extension for Leaflet Map plugin <= 6.1.1 - Cross Site Scripting (XSS) vulnerability13 Nov 20266.5
CVE-2026-125792WordPress Church Admin plugin <= 5.1.8 - Broken Access Control vulnerability13 Nov 20265.3
CVE-2026-125831WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability13 Nov 20266.5
CVE-2026-125834WordPress Imagify plugin <= 2.3.4 - Broken Access Control vulnerability13 Nov 20264.3
CVE-2026-125827WordPress Event Tickets plugin <= 5.31.0 - Broken Access Control vulnerability13 Nov 20265.3
CVE-2026-125811WordPress myCred plugin <= 4.0.2 - SQL Injection vulnerability13 Nov 20268.5
CVE-2026-125810WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability13 Nov 20264.3
CVE-2026-125809WordPress myCred plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability13 Nov 20266.5
CVE-2026-125440WordPress s2Member plugin <= 261106 - Content Injection vulnerability13 Nov 20265.3
CVE-2026-124412WordPress Slim SEO plugin <= 4.11.5 - Content Injection vulnerability13 Nov 20264.3
CVE-2026-11154713 Nov 20268.1
CVE-2026-125821WordPress MapSVG plugin <= 9.0.4 - Content Injection vulnerability13 Nov 20265.3
CVE-2026-125835WordPress JetTabs plugin <= 2.3.5 - Cross Site Scripting (XSS) vulnerability13 Nov 20266.5
CVE-2026-124409WordPress CURCY plugin <= 2.2.21 - Broken Access Control vulnerability13 Nov 20265.3
CVE-2026-125807WordPress HT Mega plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability13 Nov 20266.5
CVE-2026-125808WordPress HT Mega plugin <= 3.2.8 - Broken Access Control vulnerability13 Nov 20265.3
CVE-2026-125824WordPress WP Go Maps plugin <= 10.1.10 - Cross Site Scripting (XSS) vulnerability13 Nov 20266.5
CVE-2026-119102AI Command Filters On Any Property Bypassing Column Allowlist13 Nov 20266.5
CVE-2026-125819WordPress Gutenberg Blocks plugin <= 3.7.6 - Broken Access Control vulnerability13 Nov 20265.3
CVE-2026-118976Path Traversal in Telerik UI for Blazor Demo's Chat AI Integration Example13 Nov 20267.5
CVE-2026-128910DJI AeroScope Mobile: Hard-coded root password on the serial console13 Nov 20266.8
CVE-2026-128909DJI AeroScope Mobile: Firmware updates are not signature-verified13 Nov 20268.8
CVE-2026-10752413 Nov 20268.8
CVE-2026-128908DJI AeroScope Mobile: OS command injection leads to root code execution13 Nov 20268.8
CVE-2026-12703113 Nov 20267.7
CVE-2026-128907DJI AeroScope Mobile: Missing authentication on the management interface13 Nov 20264.3
CVE-2026-128970Missing membership acceptance check permits group share-right deletion by invitees in Psono Server13 Nov 20265.4
CVE-2026-109093X.Org Server XTestFakeInput Valuator Stack Out-Of-Bounds Write13 Nov 20268.5
CVE-2026-12710213 Nov 20267.1
CVE-2026-109094X.Org Server XRes QueryResourceBytes Swap Path Size Overflow13 Nov 20268.5
CVE-2026-8217713 Nov 20267.2